feat : use guide login only [no ci]

app/api/auth/[...all]/route.test.ts

@@ -1,13 +1,11 @@
 import { beforeEach, describe, expect, it, vi } from "vitest";
 
-const session = vi.fn();
 const handler = vi.fn(async () => Response.json({ passed: true }));
 
 vi.mock("server-only", () => ({}));
 vi.mock("better-auth/next-js", () => ({ toNextJsHandler: () => ({ GET: handler }) }));
 vi.mock("@/lib/auth/server", () => ({
-  getAuth: () => ({ api: { getSession: session }, handler }),
-  isSudlohOidcEnabled: () => true,
+  getAuth: () => ({ handler }),
 }));
 
 const { GET, POST } = await import("./route");
@@ -15,11 +13,9 @@ const { GET, POST } = await import("./route");
 beforeEach(() => {
   vi.clearAllMocks();
   process.env.BETTER_AUTH_URL = "https://guide.sudloh.com";
-  process.env.SUDLOH_OIDC_ONLY = "true";
-  session.mockResolvedValue({ user: { id: "user-1" }, session: { id: "session-1" } });
 });
 
-describe("Better Auth Sudloh boundary", () => {
+describe("Better Auth route", () => {
   it("lets Better Auth serve the local browser session", async () => {
     const response = await GET(new Request("https://guide.sudloh.com/api/auth/get-session"));
     expect(response.status).toBe(200);
@@ -27,11 +23,6 @@ describe("Better Auth Sudloh boundary", () => {
     expect(handler).toHaveBeenCalledOnce();
   });
 
-  it("permits the OIDC callback", async () => {
-    const callback = await GET(new Request("https://guide.sudloh.com/api/auth/callback/sudloh?code=code"));
-    expect(callback.status).toBe(200);
-  });
-
   it("passes mutations to Better Auth for local session checks", async () => {
     const response = await POST(new Request("https://guide.sudloh.com/api/auth/admin/create-user", {
       method: "POST", headers: { Origin: "https://guide.sudloh.com", "Content-Type": "application/json" },
@@ -40,4 +31,13 @@ describe("Better Auth Sudloh boundary", () => {
     expect(response.status).toBe(200);
     expect(handler).toHaveBeenCalledOnce();
   });
+
+  it("passes local profile changes to Better Auth", async () => {
+    const response = await POST(new Request("https://guide.sudloh.com/api/auth/change-email", {
+      method: "POST", headers: { Origin: "https://guide.sudloh.com", "Content-Type": "application/json" },
+      body: JSON.stringify({ newEmail: "[email protected]" }),
+    }));
+    expect(response.status).toBe(200);
+    expect(handler).toHaveBeenCalledOnce();
+  });
 });

app/api/auth/[...all]/route.ts

@@ -1,9 +1,5 @@
 import { toNextJsHandler } from "better-auth/next-js";
-import { and, eq } from "drizzle-orm";
-
-import { getAuth, isSudlohOidcEnabled } from "@/lib/auth/server";
-import { getDb } from "@/db";
-import { accounts } from "@/db/schema";
+import { getAuth } from "@/lib/auth/server";
 import { errorResponse, HttpError, readJson, requireSameOrigin } from "@/lib/security/http";
 
 const handlers = toNextJsHandler((request) => getAuth().handler(request));
@@ -17,17 +13,6 @@ async function mutate(request: Request) {
     requireSameOrigin(request);
     const input = await readJson(request.clone());
     const path = new URL(request.url).pathname;
-    if (["/update-user", "/change-email"].some((endpoint) => path.endsWith(endpoint))) {
-      if (isSudlohOidcEnabled() && process.env.SUDLOH_OIDC_ONLY === "true")
-        throw new HttpError(403, "manage-profile-at-sudloh");
-      const session = await getAuth().api.getSession({ headers: request.headers });
-      if (session) {
-        const [linked] = await getDb().select({ id: accounts.id }).from(accounts).where(and(
-          eq(accounts.userId, session.user.id), eq(accounts.providerId, "sudloh"),
-        )).limit(1);
-        if (linked) throw new HttpError(403, "manage-profile-at-sudloh");
-      }
-    }
     if (["/admin/create-user", "/admin/set-user-password"].some((endpoint) => path.endsWith(endpoint))) {
       const password = input && typeof input === "object" && "password" in input ? input.password : undefined;
       const newPassword = input && typeof input === "object" && "newPassword" in input ? input.newPassword : undefined;

app/api/profile/route.test.ts

@@ -7,12 +7,10 @@ const returning = vi.fn();
 const where = vi.fn(() => ({ returning }));
 const set = vi.fn(() => ({ where }));
 const write = vi.fn();
-const linkedAccounts = vi.fn();
 
 vi.mock("@/lib/commission/server", () => ({ requireCommissionUser }));
 vi.mock("@/db", () => ({ getDb: () => ({
   update: () => ({ set }),
-  select: () => ({ from: () => ({ where: () => ({ limit: linkedAccounts }) }) }),
 }) }));
 vi.mock("@/lib/media/storage", () => ({ getMediaStorage: async () => ({ write }), publicMediaUrl: (key: string) => `https://cdn.test/${key}` }));
 vi.mock("@/lib/security/rate-limit", () => ({ limitRequest: async () => undefined }));
@@ -31,7 +29,6 @@ describe("profile update", () => {
     process.env.BETTER_AUTH_URL = "https://guide.sudloh.com";
     vi.clearAllMocks();
     requireCommissionUser.mockResolvedValue({ id: "user-1", image: null });
-    linkedAccounts.mockResolvedValue([]);
     returning.mockResolvedValue([{ name: "New Name", image: null }]);
   });
 
@@ -66,9 +63,4 @@ describe("profile update", () => {
     expect(set).not.toHaveBeenCalled();
   });
 
-  it("sends Sudloh-linked users to Sudloh for profile changes", async () => {
-    linkedAccounts.mockResolvedValueOnce([{ id: "sudloh-account" }]);
-    expect((await POST(profileRequest("New Name"))).status).toBe(403);
-    expect(set).not.toHaveBeenCalled();
-  });
 });

app/api/profile/route.ts

@@ -1,7 +1,7 @@
-import { and, eq } from "drizzle-orm";
+import { eq } from "drizzle-orm";
 import sharp from "sharp";
 import { getDb } from "@/db";
-import { accounts, users } from "@/db/schema";
+import { users } from "@/db/schema";
 import { requireCommissionUser } from "@/lib/commission/server";
 import { inspectImage } from "@/lib/media/inspect";
 import { getMediaStorage, publicMediaUrl } from "@/lib/media/storage";
@@ -15,9 +15,6 @@ export async function POST(request: Request) {
   try {
     requireSameOrigin(request);
     const user = await requireCommissionUser();
-    const [sudloh] = await getDb().select({ id: accounts.id }).from(accounts)
-      .where(and(eq(accounts.userId, user.id), eq(accounts.providerId, "sudloh"))).limit(1);
-    if (sudloh) throw new HttpError(403, "manage-profile-at-sudloh");
     await limitRequest("profile-update", user.id, 20);
     if (!request.headers.get("content-type")?.startsWith("multipart/form-data;"))
       throw new HttpError(415, "expected-multipart");

app/api/profile/sync/route.ts

@@ -1,13 +0,0 @@
-import { getCustomerSession } from "@/lib/auth/server";
-import { refreshLinkedSudlohProfile } from "@/lib/auth/sudloh";
-import { errorResponse, HttpError, requireSameOrigin } from "@/lib/security/http";
-
-export async function POST(request: Request) {
-  try {
-    requireSameOrigin(request);
-    const session = await getCustomerSession();
-    if (!session) throw new HttpError(401, "unauthorized");
-    await refreshLinkedSudlohProfile(session.user.id);
-    return Response.json({ ok: true }, { headers: { "Cache-Control": "no-store" } });
-  } catch (cause) { return errorResponse(cause); }
-}